CycloneDX / CycloneDX/cyclonedx-rust-cargo

Output is target specific but does not go in target directory

Open
#820 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
Rust
Stars
178
Forks
66
PR merge metrics
No merged PRs in 30d

Description

CycloneDX picks up target-specific dependencies (as it should).
So, I need to run it for each of the multiple targets my project supports. However, by default it puts the output from the different runs in the same file.
Build output goes in a `target//release` directory, so maybe the SBOM should go there too.
There does not seem to be an option to specify the output directory, which would allow me to direct the output to a target specific directory.
`--override-filename` does not allow a directory path to be included, which might have been a different solution.
I tried changing to the desired output directory and using `--manifest-path` to find Cargo.toml, but the output was produced in the same directory as `--manifest-path`, not in the directory in which the tool was run.
I can specify `--target-in-filename` to provide disambiguation, so this is not a blocking issue.

Contributor guide

Open the contributing guide

Research direction

Start by tracing the CLI handling for --manifest-path, --override-filename, and --target-in-filename, then compare its output location with Cargo's target//release directory. Check whether existing tests cover multiple target runs or output paths. Done means each target's SBOM can be directed to, or is placed in, a target-specific directory without breaking current filename options.

Written by the indexing model from the issue text.

Assessment

Tech stack
rust
Domain
build-system, cli
Issue type
Feature
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.